GRC Associate

The role

You will manage security risks from third-party suppliers, technology partners and service providers, from onboarding through to ongoing assurance. You will also support ISO 27001 governance and compliance work and help improve GRC tooling using automation and AI.

What you will do

• Run third-party security risk assessments for new and existing suppliers, including SaaS and cloud providers
• Review supplier assurance evidence such as ISO 27001 certificates, SOC 2 reports and penetration test summaries
• Identify and document third-party security risks and recommend proportionate reductions
• Help assess security risks of AI tools and third-party AI integrations
• Partner with Procurement, Legal, Privacy and Engineering on supplier onboarding, procurement and contract renewals
• Keep third-party risk records up to date, track remediation and escalate material risks
• Help shape a risk-based approach to ongoing supplier assurance and reassessment
• Help improve the Third-Party Risk Management framework
• Support ISO 27001 assurance work, including control assessments, evidence gathering and audit preparation
• Help build and improve GRC tooling using automation and AI

Required qualifications

• Experience in information security, GRC, third-party risk management or a related cyber security discipline
• Hands-on experience running third-party security assessments or reviewing supplier assurance documentation
• Working knowledge of ISO 27001, ISO 27002 and NIST CSF
• Experience working with stakeholders across functions such as Procurement, Legal and Technology
• Strong analytical and problem-solving skills and attention to detail
• Ability to manage several assessments and competing priorities at once
• Clear written and verbal communication with technical and non-technical audiences
• A proactive, curious mindset and interest in improving security governance

Nice to have

• Experience with GRC or third-party risk platforms such as ServiceNow GRC, Archer, LogicGate, Vanta or Compyl
• Experience supporting ISO 27001 audits, ISMS maintenance or control assurance
• Familiarity with SOC 2, ISO 22301, PCI DSS or Cyber Essentials
• Experience assessing cloud services, SaaS or AI-enabled tools, or familiarity with ISO/IEC 42001 and the NIST AI RMF
• Experience automating GRC processes using workflow tools, scripting, low-code platforms or APIs
• Confident everyday use of AI tools and LLMs
• A relevant certification such as ISO 27001 Foundation or equivalent

Benefits

• Private healthcare and dental insurance
• Generous work from abroad policy
• 2-for-1 share purchase plans
• EV Scheme
• Extra festive time off
• Family-friendly benefits
• Clear career paths
• Transparent pay bands
• Personal learning budgets
• Regular learning days

About the company

Trainline is Europe's leading independent rail platform, helping millions of travellers find and book rail and coach journeys. The company has more than 1,000 employees across London, Paris, Barcelona, Milan, Edinburgh and Madrid.